Azure 租户和 Azure 订阅之间有什么区别？

Basic understanding: 基本了解：

• a tenant is associated with a single identity (person, company, or organization) and can own one or several subscriptions
  租户与单个标识（个人、公司或组织）相关联，可以拥有一个或多个订阅
• a subscription is linked to a payment setup and each subscription will result in a separate bill
  订阅与付款设置相关联，每个订阅将产生单独的账单
• in every subscription, you can add virtual resources (VM, storage, network, …)
  在每个订阅中，您可以添加虚拟资源（虚拟机、存储、网络等）

Additionally: 此外：

• Every tenant is linked to a single Azure AD instance, which is shared with all tenant’s subscriptions
  每个租户都链接到一个 Azure AD 实例，该实例与所有租户的订阅共享

• Resources from one subscription are isolated from resources in other subscriptions
  一个订阅中的资源与其他订阅中的资源隔离

• An owner of a tenant can decide to have multiple subscriptions:
  租户的所有者可以决定拥有多个订阅：

  • when Subscriptions limits are reached
    达到订阅限制时
  • to use different payment methods
    使用不同的付款方式
  • to isolate resources between different departments, projects, regional offices, and so on.
    在不同部门、项目、区域办事处等之间隔离资源。

Example 1: 示例 1：

Contoso decides to have a tenant with 2 subscriptions:
Contoso 决定拥有具有 2 个订阅的租户：Contoso decide to have a tenant with 2 subscriptions：

• one subscription for the Prod department with Credit Card A
  使用信用卡 A 订阅生产部门
• one subscription for the Dev department with Credit Card B
  使用信用卡 B 为开发部门订阅一个订阅
  (but could also be the same Credit Card as the one of another subscription)
  （但也可以是与其他订阅相同的信用卡）

In this example, the two departments share the same Azure AD database. However, resources are isolated between departments, and budgets can be separated too.
在此示例中，两个部门共享同一个 Azure AD 数据库。但是，部门之间的资源是隔离的，预算也可以分开。

Example 2: 示例 2：

A holding company decides to have 2 tenants:
一家控股公司决定拥有 2 个租户：

• one tenant for subsidiary Contoso with one subscription for Dev and Prod
  子公司 Contoso 的一个租户，以及 Dev 和 Prod 的一个订阅
• one tenant for subsidiary Fabrikam with one subscription for Dev and another subscription for Prod
  子公司 Fabrikam 的一个租户，一个用于 Dev 的订阅和另一个用于 Prod 的订阅

In this example, both companies have a different Azure AD database.
在此示例中，两家公司都有不同的 Azure AD 数据库。

Example 3: 示例 3：

You have a tenant for your personal training.
您有一个用于个人培训的租户。
In this tenant, you can have:
在此租户中，可以有：

• one free Azure subscription (linked to a credit card but not charged, and can be converted to a Pay-As-You-Go subscription after the free trial)
  一个免费的 Azure 订阅（链接到信用卡但不收费，免费试用后可转换为即用即付订阅）
• one or several Pay-As-You-Go subscriptions (linked to different credit cards)
  一个或多个即用即付订阅（链接到不同的信用卡）
• one or several Azure Pass Sponsorship subscriptions, not linked to any credit card because these subscriptions are obtained during Microsoft trainings
  一个或多个 Azure Pass 赞助订阅，未链接到任何信用卡，因为这些订阅是在 Microsoft 培训期间获得的
• one Visual Studio subscription (linked to a credit card) and with different quotas (of free resources) than the free subscription
  一个 Visual Studio 订阅（链接到信用卡），并且具有与免费订阅不同的配额（免费资源）

Despite all those subscriptions have isolated resources (per subscription), and some are free while you have to pay for others, all subscriptions share the same Azure AD database.
尽管所有这些订阅都具有独立的资源（每个订阅），并且有些订阅是免费的，而你必须为其他订阅付费，但所有订阅都共享同一个 Azure AD 数据库。

Azure tenant is a directory. Azure subscription is an object that represents a “folder” that you can put resources in. Subscriptions are tied to tenants. so 1 tenant can have many subscriptions, but not vice versa.
Azure 租户是一个目录。Azure 订阅是一个对象，表示可以将资源放入其中的“文件夹”。订阅与租户相关联。因此，1 个租户可以有多个订阅，但反之则不然。

Link: 链接：
https://learn.microsoft.com/en-us/azure/azure-subscription-service-limits

It helps to take a scenario:
采用以下场景会有所帮助：

Let’s say you logged into portal.azure.com for the first time and created a free tier account.
假设您首次登录 portal.azure.com 并创建了一个免费套餐帐户。

When you login to Azure, you have a single tenant ID associated with your account which will not change unless you ask Microsoft to delete your account(this is not your Azure domain user, this is your Microsoft subscription account – eg. [email protected]).
登录到 Azure 时，你有一个与你的帐户关联的单个租户 ID，除非你要求Microsoft删除你的帐户（这不是你的 Azure 域用户，这是你的Microsoft订阅帐户 – 例如 [email protected]）。

You will only have 1 subscription unless you’ve purchased or manage other subscriptions (by using the ‘transfer billing ownership’ function), then they will all be listed under subscriptions.
除非您购买或管理其他订阅（通过使用“转让计费所有权”功能），否则您将只有 1 个订阅，然后它们都将列在订阅下。

You will have FULL access to all “resources” associated with your tenant ID. These resources can be part of your own Azure ‘directory’ or from another domain that someone has given you access to.
你将拥有对与租户 ID 关联的所有“资源”的完全访问权限。这些资源可以是你自己的 Azure“目录”的一部分，也可以来自某人授予你访问权限的其他域。

You can create up to 20 directories, and you can belong to up to 500 directories.
您最多可以创建 20 个目录，最多可以属于 500 个目录。

When you own the subscription (eg. a free account) you’ll have full rights up to the ‘root’ of the subscription – eg. if you click on your name in the top right corner and select “… > your permissions” you see something like: Your account ‘[email protected]’ has been assigned the role ‘User Access Administrator’ (type BuiltInRole) and has access to scope /.
当您拥有订阅（例如免费帐户）时，您将拥有订阅的“根”的全部权限 – 例如。如果您单击右上角的姓名并选择“… >您的权限”，您会看到类似以下内容： 您的帐户“[email protected]”已分配角色“用户访问管理员”（键入 BuiltInRole），并有权访问范围 /。

Your resources have Role Based Access controls that you, the subscription owner, can assign to other users in your Azure Active Directory (or other trusted directories).
你的资源具有基于角色的访问控制，订阅所有者可以将这些控制分配给 Azure Active Directory（或其他受信任目录）中的其他用户。

By default, for a new subscription, the Account Administrator is assigned the “Service Administrator” privilege. This is ‘above’ the RBAC roles – there can only be one service administrator per subscription. In RBAC terms this is an ‘owner’.
默认情况下，对于新订阅，为帐户管理员分配了“服务管理员”权限。这是“高于”RBAC 角色的 – 每个订阅只能有一个服务管理员。在RBAC术语中，这是一个“所有者”。

More points: 更多要点：

A single tenant can have multiple AD directories, but a single directory can only have 1 tenant.
单个租户可以有多个 AD 目录，但单个目录只能有 1 个租户。

*It is recommended to maintain only a single tenant and manage all of your AD domains from that single tenant, otherwise the user experience between domains will not be a seamless.
*建议仅维护单个租户，并从该单个租户管理所有 AD 域，否则域之间的用户体验将无法无缝衔接。

*A tenant is directly associated with an AD resource – if you mouse over your username in the top right corner you’ll see the AD domain you’re connected to and a long alphanumeric string – that’s the same string in AD > properties.
*租户直接与 AD 资源关联 – 如果将鼠标悬停在右上角的用户名上，你将看到连接到的 AD 域和一个长字母数字字符串 – 这是 AD >属性中的相同字符串。

*If you switch to another directory (assuming you have one) your subscription name ([email protected]) doesn’t change, but the tenant ID will be different.
*如果切换到另一个目录（假设有一个目录），订阅名称 （[email protected]） 不会更改，但租户 ID 会有所不同。

References: 引用：

https://learn.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

https://marckean.com/2016/06/01/azure-vs-azure-ad-accounts-tenants-subscriptions/

https://blogit.create.pt/miguelisidoro/2019/01/07/pros-and-cons-of-single-tenant-vs-multiple-tenants-in-office-365/

This MS doc has explained everything very nicely – Subscriptions, licenses, accounts, and tenants for Microsoft’s cloud offerings
这个 MS 文档很好地解释了所有内容 – Microsoft 云产品的订阅、许可证、帐户和租户

Quoting from the Summary of the hierarchy section in the documentation:
引用文档中的“层次结构摘要”部分：

Here is a quick recap:
以下是快速回顾：

An organization can have multiple subscriptions
一个组织可以有多个订阅

• A subscription can have multiple licenses
  一个订阅可以有多个许可证
• Licenses can be assigned to individual user accounts
  许可证可以分配给单个用户帐户
• User accounts are stored in an Azure AD tenant
  用户帐户存储在 Azure AD 租户中

Later in the same section it says:
在同一部分的后面，它说：

Multiple Microsoft cloud offering subscriptions can use the same Azure AD tenant that acts as a common identity provider. A central Azure AD tenant that contains the synchronized accounts of your on-premises AD DS provides cloud-based Identity as a Service (IDaaS) for your organization.
多个 Microsoft 云产品/服务订阅可以使用充当通用标识提供者的同一 Azure AD 租户。包含本地 AD DS 的同步帐户的中央 Azure AD 租户为组织提供基于云的标识即服务 （IDaaS）。

Let us try to understand all this with the help of a real-life example. Let’s assume that I’m the owner of a company named FooBar which manufactures software products. Now here is what I’ll do to setup Azure infrastructure for my company:
让我们试着借助一个现实生活中的例子来理解这一切。假设我是一家名为 FooBar 的公司的所有者，该公司生产软件产品。现在，我将为我的公司设置 Azure 基础结构：

1. I’ll crete an Azure account using my email id.
   我将使用我的电子邮件 ID 创建一个 Azure 帐户。

2. Then for managing the employees of the company, I created below mentioned Azure Active Directories (AAD aka tenant) in my Azure account:
   然后，为了管理公司的员工，我在我的 Azure 帐户中创建了下面提到的 Azure Active Directory（AAD 又名租户）：

   • PermanentAad 永久Aad
   • AdhocAad AdhocAad（阿德霍卡阿德酒店）

   User account of all full-time employees (FTEs) will be added into PermanentAad AAD and all temporary or contractual employees will be added into AdhocAad AAD.
   所有全职员工 （FTE） 的用户帐户将被添加到 PermanentAad AAD 中，所有临时或合同员工都将添加到 AdhocAad AAD 中。

3. Similarly, I would like to manage the billing of adhoc employees and FTEs separately. So I created two subscriptions namely PermanenetSub and AdhocSub. I’ll setup a trust relationship between PermanentAad and PermanentSub. Similarly for AdhocAad and AdhocSub. So when any FTE creates an Azure resource e.g. a virtual machine(VM) then the cost of that VM will get added to total bill in PermanentSub subscription.
   同样，我想分别管理临时员工和全职员工的账单。因此，我创建了两个订阅，即 PermanenetSub 和 AdhocSub。我将在 PermanentAad 和 PermanentSub 之间建立信任关系。AdhocAad 和 AdhocSub 也是如此。因此，当任何 FTE 创建 Azure 资源（例如虚拟机 （VM））时，该 VM 的成本将添加到 PermanentSub 订阅中的总账单中。

4. Now comes the licensing part. Licenses empower a user to do things in Azure e.g. creating resources, VMs etc. I can give Enterprise Mobility + Security E5 license to an FTE so that he can create VMs for testing any stuff.
   现在是许可部分。许可证使用户能够在 Azure 中执行操作，例如创建资源、VM 等。我可以向 FTE 提供企业移动性 + 安全性 E5 许可证，以便他可以创建用于测试任何内容的 VM。

To summarize: 总结一下：

• If you want to work in Azure you need an Azure account. To create an Azure account you need an active email id.
  如果要在 Azure 中工作，则需要一个 Azure 帐户。若要创建 Azure 帐户，需要一个有效的电子邮件 ID。

• If you want to add people/employees or machines/devices who would be part of your IT infrastructure you need a tenant/AAD. You get one tenant/AAD by default when you create an Azure account. You can create more if you require for any kind of logical separation. AAD service is a global service spanning across all locations in Azure which manages all of our AAD instances. AAD is also known as Azure Active Directory, AAD, an Azure AD instance, an AAD Instance, an Azure AD Tenant, an AAD tenant, simply tenant or an organization, etc. They all mean the same. Therefore:
  如果要添加将成为 IT 基础结构一部分的人员/员工或计算机/设备，则需要租户/AAD。默认情况下，创建 Azure 帐户时会获得一个租户/AAD。如果需要任何类型的逻辑分离，可以创建更多。AAD 服务是一项跨 Azure 中所有位置的全球服务，用于管理我们所有的 AAD 实例。AAD 也称为 Azure Active Directory、AAD、Azure AD 实例、AAD 实例、Azure AD 租户、AAD 租户、简称租户或组织等。它们的意思都是一样的。因此：

  Organization == Tenant == Azure Active Directory
  组织 == 租户 == Azure Active Directory

• If you require logical separation of billing for users of your Azure account then you need multiple subscriptions. You get one subscription by default when you create a new Azure account. Subscription can be of four types as per below list:
  如果需要对 Azure 帐户的用户进行计费的逻辑分离，则需要多个订阅。默认情况下，创建新的 Azure 帐户时会获得一个订阅。订阅可以有四种类型，如下表所示：

  1. Free 自由
  2. Pay-as-you-go 即用即付
  3. Enterprise agreement 企业协议
  4. Cloud Solution Provider 云解决方案提供商

• If you want to enable the users to do things then you issue license(s) e.g. license to be able to create VM or Azure app service. Also remember that license and Role Based Access Control (RBAC) are not same although both enable you to do things in Azure portal. But they’ve different nuances which you can explore on your own.
  如果要使用户能够执行某些操作，则可以颁发许可证（例如，许可证）以创建 VM 或 Azure 应用服务。另请记住，许可证和基于角色的访问控制 （RBAC） 并不相同，尽管两者都允许你在 Azure 门户中执行操作。但它们有不同的细微差别，您可以自己探索。

Below image summarizes the above explanation. I’ve taken it from the same documentation that I referred at the starting of this answer – Subscriptions, licenses, accounts, and tenants for Microsoft’s cloud offerings
下图总结了上述解释。我从本答案开头提到的同一文档中获取了它 – Microsoft 云产品的订阅、许可证、帐户和租户

Quoting from the User accounts section in the documentation:
引用文档中的“用户帐户”部分：

So, all the user accounts and devices of an organization reside in a common Azure AD tenant/instance.
因此，组织的所有用户帐户和设备都驻留在一个通用的 Azure AD 租户/实例中。

Below are succinct descriptions of key terms and the relationship between them.
以下是关键术语及其之间关系的简明描述。

They are all sourced from official Microsoft documentation.
它们都来自Microsoft官方文档。

• Account 帐户
• Tenant 房客
• Identity 身份
• Subscription 订阅
• Resource 资源
• Resource Group 资源组

Account 帐户

To create and use Azure services, you first need to sign up [for an Azure account].
若要创建和使用 Azure 服务，首先需要注册 [Azure 帐户]。

Source: 源：
Learning Path: Manage identity and access in Azure Active Directory
学习路径：在 Azure Active Directory 中管理标识和访问权限
Module: Create an Azure account
模块：创建 Azure 帐户
Exercise: Create an Azure account
练习：创建 Azure 帐户

Tenant 房客

An Azure tenant is a single dedicated and trusted instance of Azure AD. Each tenant (also called a directory) represents a single organization. When your organization signs up for a Microsoft cloud service subscription, a new tenant is automatically created. Because each tenant is a dedicated and trusted instance of Azure AD, you can create multiple tenants or instances.
Azure 租户是 Azure AD 的单个专用且受信任的实例。每个租户（也称为目录）代表一个组织。当组织注册 Microsoft 云服务订阅时，会自动创建一个新租户。由于每个租户都是 Azure AD 的专用且受信任的实例，因此可以创建多个租户或实例。

Identity 身份

An identity is an object that can be authenticated. The identity can be a user with a username and password. Identities can also be applications or other servers that require authentication by using secret keys or certificates. Azure AD is the underlying product that provides the identity service.
标识是可以进行身份验证的对象。标识可以是具有用户名和密码的用户。标识也可以是需要使用密钥或证书进行身份验证的应用程序或其他服务器。Azure AD 是提供标识服务的基础产品。

Source: 源：
Learning Path: AZ-104: Manage identities and governance in Azure
学习路径：AZ-104：在 Azure 中管理标识和治理
Module: Configure Azure Active Directory
模块：配置 Azure Active Directory
Exercise: Describe Azure Active Directory concepts
练习：描述 Azure Active Directory 概念

Subscription 订阅

To create and use Azure services, you need an Azure subscription…you’re free to create additional subscriptions. For example, your company might use a single Azure account for your business and separate subscriptions for development, marketing, and sales departments. After you’ve created an Azure subscription, you can start creating Azure resources within each subscription.
若要创建和使用 Azure 服务，需要 Azure 订阅…您可以自由创建其他订阅。例如，你的公司可能对你的业务使用单个 Azure 帐户，并为开发、营销和销售部门使用单独的订阅。创建 Azure 订阅后，可以开始在每个订阅中创建 Azure 资源。

Source: 源：
Learning Path: Azure Fundamentals: Describe Azure architecture and services
学习路径：Azure 基础知识：描述 Azure 体系结构和服务
Module: Get started with Azure accounts
模块：Azure 帐户入门

In Azure, subscriptions are a unit of management, billing, and scale. Similar to how resource groups are a way to logically organize resources, subscriptions allow you to logically organize your resource groups and facilitate billing…An account can have multiple subscriptions, but it’s only required to have one. In a multi-subscription account, you can use the subscriptions to configure different billing models and apply different access-management policies. You can use Azure subscriptions to define boundaries around Azure products, services, and resources.
在 Azure 中，订阅是管理、计费和缩放的单元。与资源组是一种以逻辑方式组织资源的方式类似，订阅允许你以逻辑方式组织资源组并简化计费。一个帐户可以有多个订阅，但只需要有一个订阅。在多订阅帐户中，您可以使用订阅来配置不同的计费模型并应用不同的访问管理策略。可以使用 Azure 订阅来定义 Azure 产品、服务和资源的边界。

Source: 源：
Learning Path: Azure Fundamentals: Describe Azure architecture and services
学习路径：Azure 基础知识：描述 Azure 体系结构和服务
Module: Describe Azure management infrastructure
模块：描述 Azure 管理基础结构

Resource 资源

A resource is the basic building block of Azure. Anything you create, provision, deploy, etc. is a resource. Virtual Machines (VMs), virtual networks, databases, cognitive services, etc. are all considered resources within Azure.
资源是 Azure 的基本构建基块。您创建、预配、部署等的任何内容都是资源。虚拟机 （VM）、虚拟网络、数据库、认知服务等都被视为 Azure 中的资源。

Resource Group 资源组

Resource groups are simply groupings of resources. When you create a resource, you’re required to place it into a resource group. While a resource group can contain many resources, a single resource can only be in one resource group at a time. Some resources may be moved between resource groups, but when you move a resource to a new group, it will no longer be associated with the former group. Additionally, resource groups can’t be nested, meaning you can’t put resource group B inside of resource group A.
资源组只是资源的分组。创建资源时，需要将其放入资源组。虽然资源组可以包含多个资源，但一个资源一次只能位于一个资源组中。某些资源可能会在资源组之间移动，但当将资源移动到新组时，它将不再与以前的组关联。此外，资源组不能嵌套，这意味着不能将资源组 B 放在资源组 A 中。

Resource groups provide a convenient way to group resources together. When you apply an action to a resource group, that action will apply to all the resources within the resource group. If you delete a resource group, all the resources will be deleted. If you grant or deny access to a resource group, you’ve granted or denied access to all the resources within the resource group.
资源组提供了一种将资源组合在一起的便捷方法。将操作应用于资源组时，该操作将应用于资源组中的所有资源。如果删除资源组，则将删除所有资源。如果授予或拒绝对资源组的访问权限，则表示已授予或拒绝对资源组中所有资源的访问权限。

When you’re provisioning resources, it’s good to think about the resource group structure that best suits your needs.
预配资源时，最好考虑最适合需求的资源组结构。

For example, if you’re setting up a temporary dev environment, grouping all the resources together means you can deprovision all of the associated resources at once by deleting the resource group. If you’re provisioning compute resources that will need three different access schemas, it may be best to group resources based on the access schema, and then assign access at the resource group level.
例如，如果要设置临时开发环境，则将所有资源组合在一起意味着可以通过删除资源组来一次性取消预配所有关联的资源。如果要预配需要三种不同访问架构的计算资源，最好根据访问架构对资源进行分组，然后在资源组级别分配访问权限。

There aren’t hard rules about how you use resource groups, so consider how to set up your resource groups to maximize their usefulness for you.
关于如何使用资源组没有硬性规定，因此请考虑如何设置资源组，以最大限度地提高资源组的实用性。

Source: 源：
Learning Path: Azure Fundamentals: Describe Azure architecture and services
学习路径：Azure 基础知识：描述 Azure 体系结构和服务
Module: Describe Azure management infrastructure
模块：描述 Azure 管理基础结构

Adding more to existing answers , Tenant is a domain, If these are email addresses of a certain company,
在现有答案的基础上添加更多，租户是一个域，如果这些是某个公司的电子邮件地址，

• [email protected] [email protected]

The tenant can be recognized as “exampledomain”. In a practical scenario, you create a tenant against a company or a client.
租户可以被识别为“exampledomain”。在实际方案中，针对公司或客户创建租户。

Subscriptions are like another logical high-level grouping for billing which comes under a particular tenant. For example, you can create a subscription for each environment you work with in the same tenant. as an example, exampledomain.com tenant can have Development, QA, and Production subscriptions. Those will be billed separately according to the plans you take in
订阅类似于特定租户下的另一个逻辑高级计费分组。例如，可以为在同一租户中使用的每个环境创建订阅。例如，exampledomain.com 租户可以具有开发、QA 和生产订阅。这些将根据您参加的计划单独计费

Simply put, an instance of Azure AD is what an organization receives when the organization creates a relationship with Microsoft such as signing up for Azure, Microsoft Intune, or Microsoft 365.
简而言之，Azure AD 实例是组织在与 Microsoft 建立关系（例如注册 Azure、Microsoft Intune 或 Microsoft 365）时收到的内容。

A tenant is similar to a forest in an on-premise environment.
租户类似于本地环境中的林。

An Active Directory forest (AD forest) is the topmost logical container in an Active Directory configuration that contains domains, users, computers, and group policies
Active Directory 林（AD 林）是 Active Directory 配置中最顶层的逻辑容器，其中包含域、用户、计算机和组策略

Think of a tenant as a user/domain entity that is registered in Azure. Tenants are Azure ‘customer’ – a unique entity that will be registered in Azure directories. Subscription is an operational level of grouping resources. Tenants have subscriptions. Tenant is quite a useful approach, which, in my opinion, is missing in AWS.
将租户视为在 Azure 中注册的用户/域实体。租户是 Azure“客户”，是将在 Azure 目录中注册的唯一实体。订阅是对资源进行分组的操作级别。租户具有订阅。租户是一种非常有用的方法，在我看来，AWS中缺少这种方法。